Password rules are dumb, but why do websites even require passwords when they require an email address and offer a "forgot my password" link? The user clicks t

Password rules are dumb, but why do websites even require passwords when they require an email address and offer a "forgot my password" link? The user clicks the link, it sends a one-time login URL to the address, that login URL sets a cookie, and there you go. If your primary email account is hacked, you're pwned in all kinds of ways that a password won't help, e.g. "forgot my password" requests. And if you don't care about others using some junk website that requires logins, you can give them a throwaway Mailinator account.